I am trying to convert real-time searches in the dashboard to scheduled real-time searches to reduce performance overhead/tradeoff on indexer. I was looking to implement the suggestion in the below post https://answers.splunk.com/answers/247134/how-to-improve-performance-of-a-shared-dashboard-w.html I converted panels to reports, but when I click on "schedule search", I don't see an option for cron schedule coming up. Below are my "Start Time" and "Finish Time" Start Time = rt-30m Finish Time = rt If i change the starttime and finish time to -30m and now respectively, I get an option to schedule using cron. Am I doing this incorrectly or has the option to schedule real-time search has been removed in 6.2.1 ... View more

We have splunk 6.2.1 running in our environment. As part of security review procedures, any dashboards we create need to be run through an automated security review product like hailstorm. One of the attributes it is checking for is that session cookies are secured & httponly. I do see that etc/system/default/web.conf has tools.sessions.httponly and tools.sessions.secure set to True. I assume this should have secured all session cookies, but the review tool is pointing out session cookies are not secured. Excerpt of the review report generated below 1 Vulnerable (Medium 😞 https://Hostname:port number/en-US/config?autoload=1 Message: session_id_XXXX Cookie has problem(s) session_id_XXXX = dab6da5b7167dba10f6e88a8g725e319be90ed8c; Host = Hostname; Path = / 1. Cookie does not have secure attribute. Cookie Vulnerabilities Is there any other setting which needs to be enabled to make session cookies secure & httponly? ... View more

I understand that real time searches on splunk are very expensive and should be avoided. My question is an extension to what has been asked and answered to some extent in the thread below http://answers.splunk.com/answers/230777/best-practices-when-dealing-with-real-time-searche.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev Below are the details of my dashboard My application dashboard has 5 tabs and each of them have 3-4 real time searches monitoring & measuring events which happened in past 15 minutes till now i.e earliesttime = rt-15m and latesttime=rt. At any point of time only 1 or 2 users would be viewing the dashboard & that too occasionally especially after a scheduled realtime splunk search raises an alert indicating the monitored application is facing degradation of performance or lot of errors. But when users are viewing the dashboard, they prefer panels to be updated real-time & not with any lag because of mission critical nature of the application. Events come in at a very high rate . It can range from an average of 20 transactions/events per second to 200-300 transactions/events per second. Questions 1. Are there any scenario's where real time searches would be acceptable in production settings. For e.g. like in the one's i have detailed above . Or any kind of real time search (irrespective of # of users, # of searches per dashboard, window of search etc. ) is risk to splunk environment as a whole. 2. If answer to #1 above indicates real-time searches are not advisable then we can run savedsearches running every 30 seconds or 1 minute . But since panels need to refresh the latest statistics, we will have to anyways refresh the forms every 30 seconds or 1 minute. In that case, does scheduling savedsearches make any sense? Can we not just leave them as inline searches with form or panel refresh every 1 minute? Since window is just 15 minutes and don't need these searches for any reports (just real time monitoring) we don't need acceleration or summary indexing etc. ... View more

There was a problem with available space for indexing and it had slowed down. But once the problem was fixed, the indexed events are still 7 hours older than the recent event in the source file (a application log file). Since the log file is being continuously written, I wonder if splunk will ever be able to catchup: a) Is there any way, I can speed up forwarding (universal forwarder) and indexing so that splunk can catch up quickly. Since the log file is going to be used for real time monitoring of mission critical application, we cannot afford to take many hours for splunk to catch up after forwarder goes down or when indexing runs across a problem. ... View more

I want to create a panel which shows # of events in very large font size, something like a realtime counter on a big banner. I am able to create the realtime "single valued" field and change its font color by overriding singlevalue-result in application.css but for some reason I am not able to change the font-size from 24px to x-large even though it has been given in application.css. I can see in the inspect element of chrome that the font size was taken from mystyles.css then overridden by dashboard-simple-boostrap-min.css which was then again overridden but doesn't show from where Any advise will be highly appreciated. Source is <dashboard stylesheet="mystyles.css"> <label>Single Value Dasboard</label> <row> <panel> <single> <title>TotalCount</title> <searchString>index=_internal | eval cur=if(_time &gt; relative_time(now(),"-15m"),1,0) | stats count by cur | sort -cur</searchString> <earliestTime>-24h@h</earliestTime> <latestTime>now</latestTime> <option name="field">count</option> </single> </panel> </row> </dashboard> css in mystyles.css referred to in code above has: .single-result { color: #FF0000; font-size: 50px; vertical-align: -4px; margin: 0px 6px; } ... View more